Firewall & SSH access

Firewall rules

Rules live on a server's Firewall page. Provisioning opens SSH, HTTP, and HTTPS, and nothing else. A rule takes a port or an inclusive range such as 8080:8090, a protocol, and an optional source IP or CIDR. The source is how you keep a database port reachable from your office only.

Provisore applies each change to UFW as a job you can follow. The SSH, HTTP, and HTTPS rules from provisioning are marked Protected and cannot be removed.

SSH keys

Your team keeps a pool of public keys under Settings → Connections → SSH keys. A key on a server lets its owner log in as the provisore deploy user, which has passwordless sudo. Provisore accepts Ed25519, ECDSA, and RSA keys of at least 2048 bits, and each fingerprint can appear once per team.

• When a server goes active, every key in the pool is attached to it. Attach a key you add later, or detach one, under Access in the server's Settings.
• Attaching and detaching run as jobs against the server's authorized_keys. Provisore's own provisioning key is not affected.
• You cannot remove a key from the pool while it is attached to a server. Detach it from each server first, so no access is left behind by accident.
• Reading and changing the key pool needs the admin or owner role.

Access shows the ssh command for the server. Copy SSH command, in the menu at the end of the server's toolbar, copies it from any page.

What provisioning already configured

• Root login and password authentication are disabled. Keys only.
• fail2ban watches SSH.
• Unattended security upgrades are on.